From f6a262eeb1a188f00dfc2590101e0a63e3e03374 Mon Sep 17 00:00:00 2001
From: Haojun Liao <hjliao@taosdata.com>
Date: Sat, 11 Feb 2023 01:56:28 +0800
Subject: [PATCH] fix(query): fix invalid write.

---
 source/dnode/vnode/src/tsdb/tsdbRead.c      |  9 +++++----
 source/libs/executor/src/executil.c         | 22 +++++++++++++--------
 tests/script/tsim/parser/regressiontest.sim |  2 +-
 3 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/source/dnode/vnode/src/tsdb/tsdbRead.c b/source/dnode/vnode/src/tsdb/tsdbRead.c
index 7eb01206dd..8ec076fb63 100644
--- a/source/dnode/vnode/src/tsdb/tsdbRead.c
+++ b/source/dnode/vnode/src/tsdb/tsdbRead.c
@@ -694,10 +694,12 @@ static int32_t doLoadBlockIndex(STsdbReader* pReader, SDataFReader* pFileReader,
       continue;
     }
 
-    if (pBlockIdx->uid == pList->tableUidList[j]) {
-      i += 1;
+    if (pBlockIdx->uid > pList->tableUidList[j]) {
       j += 1;
+      continue;
+    }
 
+    if (pBlockIdx->uid == pList->tableUidList[j]) {
       // this block belongs to a table that is not queried.
       void* p = taosHashGet(pReader->status.pTableMap, &pBlockIdx->uid, sizeof(uint64_t));
       if (p == NULL) {
@@ -711,9 +713,8 @@ static int32_t doLoadBlockIndex(STsdbReader* pReader, SDataFReader* pFileReader,
       }
 
       taosArrayPush(pIndexList, pBlockIdx);
-    }
 
-    if (pBlockIdx->uid > pList->tableUidList[j]) {
+      i += 1;
       j += 1;
     }
   }
diff --git a/source/libs/executor/src/executil.c b/source/libs/executor/src/executil.c
index 79187b441e..b398f66e19 100644
--- a/source/libs/executor/src/executil.c
+++ b/source/libs/executor/src/executil.c
@@ -127,23 +127,29 @@ void initGroupedResultInfo(SGroupResInfo* pGroupResInfo, SSHashObj* pHashmap, in
   pGroupResInfo->pRows = taosArrayInit(size, POINTER_BYTES);
 
   size_t  keyLen = 0;
-  int32_t num = 0, iter = 0, itemSize = 0;
+  int32_t iter = 0;
+  int32_t bufLen = 0, offset = 0;
 
+  // todo move away and record this during create window
   while ((pData = tSimpleHashIterate(pHashmap, pData, &iter)) != NULL) {
-    void* key = tSimpleHashGetKey(pData, &keyLen);
+    /*void* key = */tSimpleHashGetKey(pData, &keyLen);
+    bufLen += keyLen + sizeof(SResultRowPosition);
+  }
 
-    if (pGroupResInfo->pBuf == NULL) {
-      itemSize = keyLen + sizeof(SResultRowPosition);
-      pGroupResInfo->pBuf = taosMemoryMalloc(size * itemSize);
-    }
+  pGroupResInfo->pBuf = taosMemoryMalloc(bufLen);
 
-    SResKeyPos* p = (SResKeyPos*)(pGroupResInfo->pBuf + num * itemSize);
+  iter = 0;
+  while ((pData = tSimpleHashIterate(pHashmap, pData, &iter)) != NULL) {
+    void* key = tSimpleHashGetKey(pData, &keyLen);
+
+    SResKeyPos* p = (SResKeyPos*) (pGroupResInfo->pBuf + offset);
 
     p->groupId = *(uint64_t*)key;
     p->pos = *(SResultRowPosition*)pData;
     memcpy(p->key, (char*)key + sizeof(uint64_t), keyLen - sizeof(uint64_t));
     taosArrayPush(pGroupResInfo->pRows, &p);
-    num += 1;
+
+    offset += keyLen + sizeof(struct SResultRowPosition);
   }
 
   if (order == TSDB_ORDER_ASC || order == TSDB_ORDER_DESC) {
diff --git a/tests/script/tsim/parser/regressiontest.sim b/tests/script/tsim/parser/regressiontest.sim
index c08b1bbf27..8f3ad542d0 100644
--- a/tests/script/tsim/parser/regressiontest.sim
+++ b/tests/script/tsim/parser/regressiontest.sim
@@ -165,7 +165,7 @@ if $data00 != 10 then
   return -1
 endi
 
-sql select last_row(*) from st1 group by a
+sql select last_row(*) from st1 group by a order by a desc
 if $rows != 2 then
   return -1
 endi
-- 
GitLab